User's Manual

4/1/05 Local MAC Filter
OL-7426-02
• If you want to change the 802.1X encryption for an Cisco 1000 Series lightweight access point
WLAN (not a Third-Party WLAN), use the following command:
>config wlan security 802.1X encryption <wlan id> [40/104/128]
where <WLAN id> = 1 through 16, and [40/104/128] = 40/64, 104/128 (default) or 128/152
encryption bits (default = 104/128).
WEP KeysWEP Keys
Cisco Wireless LAN Controllers can only control WEP keys across Cisco 1000 Series lightweight access
points.
• Use the show wlan <wlan id> command to check the security settings of each WLAN. The
default is 802.1X with dynamic keys enabled.
• If you want to configure the less-robust WEP (Wired Equivalent Privacy) authorization policy,
turn 802.1X off:
>config wlan security 802.1X disable <wlan id>
where <wlan id> = 1 through 16.
• Then configure 40/64, 104/128 or 128/152 bit WEP keys on 802.1X disabled WLANs using the
following command:
>config wlan security static-wep-key encryption <wlan id> [40/104/128] [hex/
ascii] <key> <key-index>
where:
- <wlan id> = 1 through 16;
- [hex/ascii] = key character format;
- <key> = Ten hexadecimal digits (any combination of 0-9, a-f, or A-F), or five printable
ASCII characters for 40-bit/64-bit WEP keys, 26 hexadecimal or 13 ASCII characters
for 104-bit/128-bit keys, or 32 hexadecimal or 16 ASCII characters for 128-bit/152-bit
keys; and
- <key-index> = 1 through 4.
Dynamic WPA Keys and Encryption
Dynamic WPA Keys and Encryption
Cisco Wireless LAN Controllers can only control WPA (Wi-Fi Protected Access) authorization policy
across Cisco 1000 Series lightweight access points.
• Use the show wlan <wlan id> command to check the security settings of each WLAN. The
default is 802.1X with dynamic keys enabled.
• If you want to configure the more-robust WPA authorization policy, turn 802.1X off:
>config wlan security 802.1X disable <wlan id>
where <wlan id> = 1 through 16.
• Then configure authorization and dynamic key exchange on 802.1X disabled WLANs using the
following commands:
>config wlan security wpa enable <wlan id>
>config wlan security wpa encryption aes-ocb <wlan id>
Note: One unique WEP Key Index can be applied to each WLAN. Because there are
only four <key-index> numbers, only four WLANs can be configured for Static WEP
Layer 2 encryption. Also note that some legacy clients can only access Key Index 1
through 3 but cannot access Key Index 4.